Context
CVE-2026-48063 / GHSA-qvv5-jq5g-4cgg (CVSS 9.3) affects baileys >= 7.0.0-rc.1, < 7.0.0-rc.12, allowing a remote party to inject a forged messages.upsert with attacker-chosen key and payload.
The latest stable release, v2.3.7 (2025-12-05), ships "baileys": "7.0.0-rc.9" — inside the affected range — and main still declares rc.9 today.
The dependency was already bumped to 7.0.0-rc13 on develop in #2575 (merged 2026-06-15), where package.json now reads version 2.4.0.
Question
Is a stable 2.4.0 release planned, and is there an ETA?
For production deployments that cannot run homolog/develop builds, is there a recommended path to the patched baileys — for example a 2.3.x patch release that only bumps the dependency?
Why it matters
We run v2.3.7 in production. As an interim mitigation we drop inbound payloads carrying requestId / protocolMessage at our webhook boundary (the workaround from the advisory), but that only covers events Evolution forwards — it cannot cover anything handled internally.
Thanks for the project and for any guidance.
Context
CVE-2026-48063 / GHSA-qvv5-jq5g-4cgg (CVSS 9.3) affects baileys
>= 7.0.0-rc.1, < 7.0.0-rc.12, allowing a remote party to inject a forgedmessages.upsertwith attacker-chosen key and payload.The latest stable release, v2.3.7 (2025-12-05), ships
"baileys": "7.0.0-rc.9"— inside the affected range — andmainstill declares rc.9 today.The dependency was already bumped to
7.0.0-rc13ondevelopin #2575 (merged 2026-06-15), where package.json now reads version2.4.0.Question
Is a stable 2.4.0 release planned, and is there an ETA?
For production deployments that cannot run
homolog/developbuilds, is there a recommended path to the patched baileys — for example a 2.3.x patch release that only bumps the dependency?Why it matters
We run v2.3.7 in production. As an interim mitigation we drop inbound payloads carrying
requestId/protocolMessageat our webhook boundary (the workaround from the advisory), but that only covers events Evolution forwards — it cannot cover anything handled internally.Thanks for the project and for any guidance.